I know nothing about the Belgian Center for Cybersecurity, but the fact that they are running a platform that has been infamous for its security issues for 25 years, and been considered essentially obsolete for 15 years, immediately makes me not take them seriously.

This is like a Health Ministry recommending leech therapy to its employees.

What platform hasn't had security issues?

Anyway.

CCB is overtly a marketing organization, not an IT security one.

IIRC they don't even host their own website, The Chancellery of the Prime Minister does it for them.

> What platform hasn't had security issues?

That's reducing things too far. "What car manufacturer hasn't had car crashes?" All cars are equally safe?

There's a vast difference between different languages and CMSs and how likely it is for critical flaws to occur. PHP has a horrible track record and continues to surprise us negatively.

Given the % of traffic of the web it serves and over how long, I actually wonder if you have any proof that PHP actual track record in on the bad side because I think it will probably be on the better side actually, same for Wordpress specifically.

That's the wrong metric as it ignores the effort people put into securing these ecosystems. Vulnerabilities per kloc would be more reasonable.

This attitude is what needs to change if we are going to be serious about security. Everything needs to be checked.